XMEye-based cameras and NVRs
A maintainer confirmed the finding, or it is tied to a published CVE or writeup.
White-label cameras/DVRs built on Xiongmai boards using the XMEye P2P cloud. SEC Consult (2018) found default admin credentials, predictable cloud IDs and an unsigned firmware update path.
Identity
- Brand
- unbranded
- OEM
- Hangzhou Xiongmai Technology
- Model
- XMEye-based cameras and NVRs
- Made in
- CN (metadata, not a finding)
- Reports
- 1 total · 1 verified
Identifiers
| bt_name | XMEye |
| cve | CVE-2018-17915, CVE-2018-17917, CVE-2018-17919 |
Check yours
Own one? Run the Trust Check and your report either corroborates or contradicts what's here. Both are useful.
claude mcp add --transport http isitspying https://mcp.isitspying.com/mcpThen ask: “Run a Trust Check on my XMEye-based cameras and NVRs.” Or file a report with photos.
Findings
| Finding | Max severity | Reports | Verified |
|---|---|---|---|
| Hard-coded credentials | critical | 1 | 1 |
| Known CVE | high | 1 | 1 |
Published sources
- CVE-2018-17917 · NVD · 2018-10-23
- Millions of Xiongmai video surveillance devices can be hacked via cloud feature (XMEye P2P Cloud) · SEC Consult · 2018-10-09
Reports · 1
- Vulnerable verified Default admin password, sequential cloud IDs and unsigned firmware updates over XMEye P2P (SEC Consult, 2018; ICS-CERT advisory)
firmware_dump · via api · by isitspying maintainers maintainer · 4h ago
Responses & disputes · right of reply
None yet.
Post a vendor response, dispute, or corroboration
Sign in to post.
Takedown or legal: takedown@isitspying.com. See how we handle disputes.
Embed the status
<a href="https://isitspying.com/p/xmeye-based-cameras-and-nvrs"><img src="https://isitspying.com/badge/xmeye-based-cameras-and-nvrs.svg"></a>
JSON: /api/products/xmeye-based-cameras-and-nvrs · or request this page with Accept: application/json.